> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyperdash.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security practices

> How to store, scope, and rotate your keys.

* **Store keys in a secrets manager or environment variables**, never in code, logs, or prompts.
* **Keep keys on your server.** Never ship a key in a browser bundle, mobile app, or public repository. Browser apps should call your backend, and your backend calls us.
* **Use one key per service** with the narrowest scopes, an expiry, and an IP allowlist where the caller's addresses are fixed.
* **Cap spend for scripts and agents** with the Agent preset, which sets a daily credit budget and a per-request maximum.
* **Rotate keys on a schedule** with an overlap, so you can deploy the new secret before the old one stops working.
* **If a key may have leaked, revoke it immediately** (or rotate it with no overlap). Revocation takes effect within about 5 seconds.
* **Always call the API over HTTPS.**

Workspace admins can require an IP allowlist on every key, set a maximum key lifetime, and allow or block keys that never expire.

Report vulnerabilities to [sales@hyperdash.com](mailto:sales@hyperdash.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.